{"id":"CVE-2026-89614","summary":"ntfs: bound the free-cluster bitmap scan to the volume","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: bound the free-cluster bitmap scan to the volume\n\nvol-\u003elcn_empty_bits_per_page is sized from vol-\u003enr_clusters at mount, but\nntfs_cluster_alloc() bounds its scan of that array by the size of $Bitmap.\nThose are independent on-disk quantities and the mount-time check only\nrejects a $Bitmap that is too small, so an image whose $Bitmap covers more\nclusters than the volume has lets the scan index past the array.  A run\nwhose LCN lies in that gap takes the allocator straight there, since the\ncaller passes the file's own last LCN as its locality hint.  KASAN reports\na slab out-of-bounds read when a file on such a volume is extended.\n\nClamp the scan to what that array covers, mirroring the max_index\ncalculation the mount-time scan already uses, and reject a decoded LCN\nat or beyond nr_clusters in the mapping pairs decoder.  Conforming\nvolumes are unaffected.","modified":"2026-09-13T03:47:19.651983297Z","published":"2026-09-11T19:45:14.747Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89614.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/19cac7902a8ab748e15f98ddaafcf5f8882be21d"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dc15a9f5307d5372aef3b64bf3ed7802f530c471"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89614.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89614"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"11ccc9107dc460de28af90fac1f42404d9802735"},{"fixed":"dc15a9f5307d5372aef3b64bf3ed7802f530c471"},{"fixed":"19cac7902a8ab748e15f98ddaafcf5f8882be21d"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89614.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.2.4"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89614.json"}}],"schema_version":"1.9.0"}